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DETAILED ACTION 
Continued Examination Under 37 CFR 1.114 

1. A request for continued examination under 37 CFR 1.114, including tlie 
fee set fortin in 37 CFR 1.17(e), was filed in this application after final rejection. Since 
this application is eligible for continued examination under 37 CFR 1.114, and the fee 
set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office 
action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
February 13, 2009 has been entered. Claims 1-27 are pending. Claim 28 is canceled 
by the applicant. At this time, claims 1-27 are still rejected. 

Response to Arguments 

2. Applicant's arguments filed February 13, 2009 have been fully considered, 
but they are not persuasive. Applicant's arguments with respect to claim 1 has been 
considered but are moot in view of the new ground(s) of rejection. 

As mentioned in the previous office action, although claim 22 has 
"storage" language, it does not proof to be statutory, since this term "computer-readable 
storage medium" does not support anywhere in the specification, which could construe 
as new matter. Therefore, claim 22 is still found non-statutory. In addition, the 
specification still recites a orooaaated signal (see paragraph [0012] of page 4 of 
specification), wherein the computer program product could embodied and transferred 
via a propagated signal. Therefore, the 101 rejection is still maintained. 

Applicant further argues: 

Liang does not teach the limitation of claim 1, wherein quantify (e.g. 
determine or pre-determine) damages avoided by one or more blocked attack. 

Examiner respectfully disagrees with the applicant and still maintains that: 
Liang's system and method for effectively managing damage caused by a 
computer virus epidemic in a network environment by effectively and rapidly distributing 
antivirus protection and cure measures within the network so as to optimally 
reduce the level of damage during the virus epidemic (emphasis added) (column 
2, lines 28-33 of Liang). Furthermore, Liang teaches a further embodiment according 



Application/Control Number: 10/824,273 
Art Unit: 2438 



Page 3 



to the invention for finding a virus is by searching the modification sections in files of the 
network system. Initially, the system finds a modified file in a predetermined time 
interval. The system then determines a first plurality of modified sections of the 
modified file. The system finds a second modified file in the predetermined time 
interval. Next, the system determines a second plurality of modified sections in the 
second file. The system compares the first modified file against the second modified 
file. The process is repeated for other files being modified in the predetermined time 
period. The management server receives info on the conditions of the virus infection. If 
no virus is found, i.e., all the modified sections from different modified files are not 
identical nor similar, then the process comes to the end. Otherwise, the management 
server is informed that there is possibly attack a virus is when modified sections from 
different modified files are identical or similar. The system accordingly quarantine an 
area containing device nodes having files with the modified sections. Finally, the 
system transfers an antivirus task into said the quarantine area for finding and 
eradicating the virus (column 2, line 66 through column 3, line 19 of Liang). Therefore, 
Liang, alone, could anticipate the limitation of claim 1. 

The fact that Examiner may not have specifically responded to any 

particular arguments made by Applicant and Applicant's Representative, should not be 

construed as indicating Examiner's agreement therewith. 

Claim Objections 

3. Claim 22 is objected to because of the following informalities: Claim 22 
recites "a computer program embodied in a computer-readable storage medium", 
wherein the computer-readable storage medium does not disclose anywhere in the 
disclosure. Appropriate correction is required. 

Claim Rejections - 35 USC §112 

4. Claim 16 are rejected under 35 U.S.C. 112, second paragraph, as being 
incomplete for omitting essential structural cooperative relationships of elements, such 
omission amounting to a gap between the necessary structural connections. See 
MPEP § 2172.01. The omitted structural cooperative relationships are: component or 
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unit or module wherein claim element is a means (or step) plus function that invokes 35 
U.S.C. 112, sixth paragraph. However, written description fails to clearly link or 
associate the disclosed structure, material, or acts to the claimed function such that one 
of ordinary skill in the art would recognize what structure, material, or acts perform the 
claimed invention. Thus, these essential missing component or unit or module is 
important and necessary to connect its relationship with the step of processing. 
Appropriate correction is required. 

Claims 17-21 have limitation that are similar to those of claim 16, thus it is 
rejected with the same rationale applied against claim 16 above. 

Claim Rejections - 35 USC § 101 

5. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

6. Claims 10-27 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

a. Referring to claim 22: 

Claim 22 recites "a computer program embodied in a computer- 
readable storage medium, and comprising computer instructions for: quantifying 
damages avoided by one or more blocked attacks; and calculating security protection 
consumption during a period of time." It appears that any digital or analog signal can be 
transmitted to recordable type media to be stored thereon which direct the claims signal 
per se, therefore, claim 22 is non-statutory. In addition, the claim is clearly a software 
program and it is non-statutory as not being tangibly embodied in a manner so as to be 
executable. Furthermore, applicant has pointed out in the specification (paragraph 
[0012] of page 4) that the computer readable medium may comprise a disk, a device, 
and/or a propagated signal, which clearly including intangible media such as signals, 
carrier waves, transmissions, optical waves, transmission media or other media 
incapable of being touched or perceived absent the tangible medium through which they 
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are conveyed. Therefore, claim 22 recites a non-statutory subject matter. Appropriate 
correction required. See MPEP 2106. 

Claims 23-27 are depended on claim 22, thus they are rejected with 
the same rationale applied against claim 22 above. 

b. Ref erring to claim 10: 

i. This claim has limitations that is similar to those of claim 22, thus it 
is rejected with the same rationale applied against claim 22 above. 

Claims 11-15 are depended on claim 10, thus they are rejected with 
the same rationale applied against claim 10 above. 

c. Referring to claim 16: 

i. This claim has limitations that is similar to those of claim 22, 
thus it is rejected with the same rationale applied against claim 22 above. 

Claims 17-21 are depended on claim 16, thus they are 
rejected with the same rationale applied against claim 16 above. 

Claim Rejections - 35 USC § 102 

7. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this Office 
action: 

A person shall be entitled to a patent unless - 

(e) the invention was deschbed in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

8. Claims 1-27 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Liang (US 7,062,553 B2). 

a. Referring to claim 1: 

i. Liang teaches a system comprising: 
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(1) a processor (column 4, line 29; column of Liang; and 
a memory, coupled to the processor, wherein the memory is configured to provide the 
processor with instructions (column 8, lines 38-44 of Liang) which when executed 
cause the processor to quantify (e.g. determine or pre-determine) damages avoided by 
one or more blocked attacks (column 2, line 66 through column 3, line 19; and 
column 7, line 66 through column 8, line 4 of Liang); and calculate security 
protection consumption during a period of time (see abstract; column 2, lines 34-44; 
column 11, lines 7-20 of Liang). 

b. Referrinp to claim 2: 

\. Liang further teaches: 

(1) wherein calculating security protection consumption 
further includes determining whether a blocked attack would have exploited a network 
vulnerability (column 9, lines 1-11 of Liang). 

c. Referring to claim 3: 

i. Liang further teaches: 

(1) wherein determining whether a blocked attack would 
have exploited network vulnerability includes replaying the attack on an internal network 
(e.g., LAN) (column 9, lines 1-11 of Liang). 

d. Referring to claim 4: 

\. Liang further teaches: 

(1) further comprising a scanner configured to scan one 
or more devices for vulnerabilities (column 10, lines 22-31 and 51-63 of Liang). 

e. Referring to claim 5: 

\. Liang further teaches: 

(1) wherein the scanner is configured to quantify the risk 
of one or more devices (column 11, lines 7-20 of Liang). 

f. Referring to claim 6: 

i. Liang further teaches: 
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(1) wherein tine scanner is located within a customer 
network (column 10, lines 51-63 of Liang). 

g. Referring to claim 7: 

\. Liang further teaches: 

(1) further comprising an intrusion suppression module 
configured to block attacks (column 2, lines 40-44; column 7, line 66 through 
column 8, line 2 of Liang). 

h. Referring to claim 8: 

i. Liang further teaches: 

(1) wherein the intrusion suppression module is 
configured to maintain a list of attacks sustained and blocked during a period of time 
(column 6, lines 56-67; column 2, lines 34^4; column 11, lines 7-20 of Liang). 

i. Referring to claim 9: 

i. Liang further teaches: 

1) wherein the intrusion suppression module is located 
outside (e.g., remote location) a customer network (column 9, lines 5-7 of Liang). 

j. Referring to claims 10-15: 

i. These claims consist a network security method to 
implement from the network security apparatus of claim 1 , thus they are rejected with 
the same rationale applied against claims 1-9 above. 

k. Referring to claims 16-21: 

i. These claims have limitations that are similar to those of 
claims 1-9, thus they are rejected with the same rationale applied against claims 1-9 
above. 

I. Referring to claims 22-27: 

i. These claims consist a computer program stored on a 
computer-readable storage medium to implement by the network security method of 
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claim 10 from the system of claim 1, thus they are rejected with the same rationale 
applied against claims 1-9 above. 

Claim Rejections - 35 USC § 103 

9. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

10. Claims 1-9 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Liang (US 7,062,553 B2), and further in view of Colson et al (US 2003/0128229). 

a. Referring to claim 1: 

i. Liang teaches a system comprising: 

(1) a processor (column 4, line 29; column of Liang; and 
a memory, coupled to the processor, wherein the memory is configured to provide the 
processor with instructions (column 8, lines 38-44 of Liang) which when executed 
cause the processor to quantify (e.g. determine or pre-determine) damages avoided by 
one or more blocked attacks (column 2, line 66 through column 3, line 19 of Liang); 
and calculate security protection consumption during a period of time (see abstract; 
column 2, lines 34-44; column 11, lines 7-20 of Liang). 

ii. Although Liang teach the processor, memory as shown in 
column 8, lines 38-44, Liang does not clearly mention that memory is coupled or 
associated with CPU or processor to execute the program task (if indeed is not 
inherently). However, Gupta clearly teaches this limitation in Figure 3 and more detail 
on column 4, lines 7-13 of Gupta. 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) modified the invention of Liang (if indeed is not 
inherently) with the teaching of Gupta to execute the program for antivirus control in a 
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network system and, more particularly, damage control against virus outbreak in a 
network environment with a plurality of device nodes under malicious code attack 
(column 1 , lines 1 5-1 8 of Liang). 

iv. The ordinary skilled person would have been motivated to: 

(1) modified the invention of Liang (if indeed is not 
inherently) with the teaching of Gupta for effectively executing the program for 
managing damage caused by a computer virus epidemic in a network environment by 
effectively and rapidly distributing antivirus protection and cure measures within the 
network so as to optimally reduce the level of damage during the virus epidemic 
(column 2, lines 29-33 of Liang). 

b. Referring to claim 2: 

I. Liang further teaches: 

(1) wherein calculating security protection consumption 
further Includes determining whether a blocked attack would have exploited a network 
vulnerability (column 9, lines 1-11 of Liang). 

c. Referring to claim 3: 

i. Liang further teaches: 

(1) wherein determining whether a blocked attack would 
have exploited network vulnerability includes replaying the attack on an Internal network 
(e.g., LAN) (column 9, lines 1-11 of Liang). 

d. Referring to claim 4: 

i. Liang further teaches: 

(1) further comprising a scanner configured to scan one 
or more devices for vulnerabilities (column 10, lines 22-31 and 51-63 of Liang). 

e. Referring to claim 5: 

\. Liang further teaches: 

(1) wherein the scanner is configured to quantify the risk 
of one or more devices (column 11, lines 7-20 of Liang). 



Application/Control Number: 10/824,273 
Art Unit: 2438 



Page 10 



f. Referring to claim 6: 

i. Liang furtlier teaclies: 

(1) wlierein tine scanner is located witlnin a customer 
networl< (column 10, lines 51-63 of Liang). 

g. Referring to claim 7: 

1. Liang furtlier teaches: 

(1) further comprising an intrusion suppression module 
configured to block attacks (column 2, lines 40-44; column 7, line 66 through 
column 8, line 2 of Liang). 

h. Referring to claim 8: 

i. Liang further teaches: 

(1) wherein the intrusion suppression module is 
configured to maintain a list of attacks sustained and blocked during a period of time 
(column 6, lines 56-67; column 2, lines 34-44; column 11, lines 7-20 of Liang). 

i. Referring to claim 9: 

i. Liang further teaches: 

1) wherein the intrusion 
suppression module is located outside (e.g., remote location) a customer network 
(column 9, lines 5-7 of Liang). 

Conclusion 

1 1 . Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Thanhnga (Tanya) Truong whose telephone number 
is 571-272-3858. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Gilberto Barron can be reached at 571-272-3799. The fax and 
phone numbers for the organization where this application or proceeding is assigned is 
571-273-8300. 
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Any inquiry of a general nature or relating to the status of this application 
or proceeding should be directed to the receptionist whose telephone number is 571- 
272-2100. 



/Thanhnga B. Truong/ 

Primary Examiner, Art Unit 2438 
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April 26, 2009 



